POLICY OF RECORDING PERSONAL DATA VIA VIDEO SURVEILLANCE SYSTEM

The herein Policy describes the terms and conditions, under which a closed circuit television system (CCTV system) has been installed and is in function in Alimos Marina by the company "DEVELOPMENT OF NEW ALIMOS MARINA CONCESSION SINGLE MEMBER SOCIETE ANONYME"and with the distinctive title “DEVELOPMENT OF NEW ALIMOS MARINA SINGLE MEMBER S.A.”(based in Kifissia, Attica, 25 Ermou Street, VAT Number 801197209, Trade Registry number  No. 151536301000), (hereinafter the "Company").
The Company has concluded the Concession Agreement dated 13-05-2020, granted the right to use, operate, manage and exploit the mobile  and / or real estate  assets within the land and / or sea zone of Alimos Marina, for a time period of forty (40) years (the "Project" or "Concession") with the Hellenic Republic Asset Development Fund ("HRADF"), the Greek Republic ("GR") and the Hellenic Public Properties Company (HPPC), under the specific terms and conditions described in the Concession Agreement and in the other contractual documents that have been signed for the Project, whereas since 01/01/2021 ("Date of Commencement of the Concession"), the company "DEVELOPMENT OF NEW ALIMOS MARINA SINGLE MEMBER S.A." is the successor party for the operation and management of Alimos Marina.
This Policy of recording personal data via video surveillance system (hereinafter the "Policy"), aims to provide information and further briefing to visitors/users/customers/counterparties/ employees of Alimos Marina (hereinafter "the Users") regarding the processof their personal data,due to the aforementioned video surveillance system. Moreover, this Policy includes a description of the rights of Users of Alimos Marina, regarding the protection of their personal data and also explains what  kind of personal information the Company collects in this context, and how this data is handled.

Α. FIELD OF APPLICATION – SCOPE

The installed video surveillance system (CCTV) records the motions of the incoming data subjects, in the area of ​​Alimos Marina as analyzed below:
The circuit is installed only to protect people and property.
Audio recording capacity is not enabled.
The video surveillance system is not used to monitor employees at their workplace or to record the movements and habits of the Users of Marina, except for easier monitoring and security in its public areas, where, due to the high value of assets located within the Marina, it is obligatory  to take measures, such as monitoring he area through  video surveillance system,in order to achieve the protection of goods, merchandise, assets and persons in the supervised area of ​​Alimos Marina.

Β. DATA CONTROLLER

The Company is the Controller of your personal data, received through the video surveillance system, according to the General Regulation 2016/679 of the European Union (General Data Protection Regulation, hereinafter referred to as "GDPR"), Law 4624/2019, as in force, the relevant Guidelines  of theHellenic Data Protection Authority(HDPA) (Guideline 1/2011 "Use of video surveillance systems for the protection of persons and property") and the relevant Guidelines of the European Data Protection Board (Guideline 3/2019 on processing of personal data through video devices).
The Company has installed in several key spots in the public areas of AlimosMarina,  informatory signs,  according to the standards and relevant guidelines of the Hellenic Data Protection Authority, where the Users of Marina are thoroughly informed about the spots,  where recording cameras have been installed, as well as about the contact details of the Company, so that anyone shall send a query,  regarding the process of his personal data (see below under H).
The Company processes the absolutely necessary data (data minimization) for the protection of goods and persons in the supervised area of ​​Alimos Marina and does not process additional personal data, for scopes  other than the predetermined and described above.

C. LEGALBASIS FOR THE DATA PROCESS

The legal basis for the process of personal data, which is recorded via the video surveillance system, is articles  6.1.c and f of the General Data Protection Regulation (GDPR). The process is mandatory for the Controller’s compliance with his legal obligation, as per  the proper preservation and protection of the vessels, docking  in Alimos Marina (art. 3 of the General Regulation of Operation of Tourist Ports, Joint Ministerial Decision no. T/9803, no. 1323 B’/16-09-2003Government Gazette), as well as for the purposes of the legal interests pursued by the Company (protection of persons and property in case of illegal events).
The area  ofAlimos Marina and the goods located within, must be constantly protected fromillicit  acts, such as cause of body harm  or material damage to the port facilities, adjacent vessels, port equipment and personnel or to persons or  third partiesassets. The same applies to the safety of life, physicalcomposure, health, as well as to  the property of staff and third parties,  legally placed  in the supervised area.
The process of personal data is limited to the minimum, absolutely necessary extent, in order to achieve the aformentioned scope  of process, i.e. only data of image is collected and the recording  is limited only to areas,which, due to the existing circumstances, are perceived  as highly dangerous for illicit acts to take place, e.g theft.
It is expressly noted that, on areas where the privacy of the recorded persons, may be severely restricted,under no circumstances takes place camera focus,  and generally, when there may be high  possibility of excessive interference with the personal data of  the Users of Marina. Finally, upon balancing the interests of the  persons, whose personal data may be processed, and the legal interest of the Controller for the safety  of the supervised area  and the protection ofthe appearing persons’ rights, in case of danger, due to the previously mentioned, the latter  seems to prevail.

D. PROCESSOF DATA – THE PROCESSOR

The process of the recorded  personal data obtained via the video surveillance system, has been assigned  by the Company, as the Controller, to the company “G4S Secure Solutions S.A.” (hereinafter referred to as "G4S"), based in Metamorfosi, Attica, at Sorou Street no. 7, P.C. 14452, withTrade Registry no. 002745601000, VAT no. 094500633 Tax Office: FAE Athens). The company G4S processes the recorded data as the Processor, under a contract signed between the Company and G4S, where the terms and obligations of the parties,regarding the process of personal data,  as set out in Articles 24 and 28 of GDPR, are thoroughly reported.
The access to the recording material, is restricted to  Company’s and G4S’s employees, specially authorized for  that scope,  whereas  only specific and authorized employees of the Company and G4S, have the permission to watch live footage.
The employees who are authorized to monitor the recording system, are aware of the scope of the process and the permitted use of personal data recorded by the video surveillance system, and are bound by relevant confidentiality and discretion clauses.
In any case, the personal data recorded, are not disclosed or transmitted to third parties, except only upon consent of the persons depicted in the relevant log files.
Excluding the aforementioned, your data may be transferred to public authorities as well as to other third parties,  when required by applicable law, including the Company's compliance with court decisions, and in the occurrence  of illicit acts, where  the competent judicial, prosecuting, police and / or port authorities, within the framework of their responsibilities, legally request data, which are useful in the context of investigation and preliminary examination of the above acts.In any case,  the Company's Data Protection Officer is immediately, respectively informed.

Ε. DATA RECORDING THROUGH THE VIDEO SURVEILLANCE SYSTEM

For the surveillance of the facilities of Alimos Marina, digital (IP) fixed bullet cameras, as well as mobile cameras (PTZ) with rotating capability, which support software for embedding image analysis algorithms (Video Content Analytics) and which compose  the video surveillance system of the Marina, have been installed and are in use  since 01/01/2021.
The aforementioned  cameras do not record sound while, mainly, they monitor the docks of boats (piers and quays), the  land area where the boats are located during winter period, and the surrounding area of ​​the Marina’sHeadquarters. The datarecorded  consistof visual data. The data and the control of the system, end up in a properly configured space at the Headquarters of the Marina, where the Control Room is located, in which the respective equipment for data collection-recording andcamera surveillance are located, together withthe work position of the guard-operator. The network allows the transfer of an image, received from each camera, in real time, directly to the equipment of the control center. The video-image data are encoded through  a compression algorithm and saved in the storage media.
The retention period ofthe  personal data recorded by the video surveillance system is ten (10) days, except in cases of acts against a person or property, where the respective  personal data for the specific event,are kept in a separate file for thirty (30) days.
Upon the expiration of the retention period, ie after the expiration of the aforementioned  ten (10) days, the personal data that have been recorded, are automatically erased.

F. DATA SECURITY MEASURES

The Company, in the context of the specific process of personal data, has taken the following applicable Data Security Measures:

• The computers of the Users have antivirus software protecting them from malicious software.
• Natural access control mechanisms are applied at the Marina facilities.
• Physical protection measures of the critical equipment used for the process,  areapplied (e.g. structured cabling, etc).
• Measures of protection against natural disasters are applied (e.g. fire safety system, etc.).
• User passwords for software supported by the surveillance system.
• Implementation of  software-level security policies,  to prevent unauthorized access.
• Maintenance of the information systems used in the context of the process.

The  aforementioned  security measures applied by the Company, are updated either on a regular basis or on an “ad hoc” (by case) basis, due to possible  emergency circumstances, so that these data security measures,shall  always be effective and provide the highest  possible degree of protection to the information and personal data being processed,  in accordance with the above reported.

G. TRANSMISSION OF PERSONAL DATA

The Company may transmit the personal data of the subjects, only to third party services   providers,  whoperform services on behalf of the Company, as per the scopes described in this Policy, to the extent that this is necessary for the implementation of the scope  of the process. In this case, the Company will take all the necessary measures, so that the services providers, shallbe specifically authorized for this purpose and completelybound byconfidentiality, and the obligations pursuant to the legal framework, regarding the collection and process of personal data.
Moreover, your data may be transferred to public authorities, as well as to other third parties, when required by applicable law, pursuant to the provisions of point D of this Policy.

H. RIGHTS OF DATA SUBJECTS

The Company, in order to preserve these data in accordance with the provisions of the General Data Protection Regulation 2016/679 and Law 4624/2019, takes all mandatory technical and organizational measures, for the secure process of these data,in order to ensure the appropriate security level of data against risks e.g. destruction, loss, alteration, unreasonable disclosure / access, unauthorized read-copy, modification or erasure of personal data,as well as the confidentiality, integrity, security, availability and reliability of the process systems and services, on an uninterrupted  basis.

The Company, does not process the above data for different scopes   than the aforementioned, and only processes theabsolutely necessary personal data, for the scope of each process, which always takes place on a legitimate  basisand in accordance with the spirit and terms of the General Regulation, Law 4624/2019 and the effective legislation.
The personal data processed by the Company, are legally kept for the entire period necessary, for the fulfillment of the scope of the process. Upon the expiration of this period, the data are erased, unless otherwise specified by the applicable legal and regulatory framework oras required to defend the Company’s rights before a judicial  or other competent Authority.
As a data subject, anyone has, under specific terms, the right to access the recorded data concerning him, as well as the right to receive the above data, in a structured, commonly used and machine-readable format (portability right), the right of correction,in case  his data is inaccurate, the right of deletion of personal data concerning him, unless its preservation is mandatory by law, the right of restriction of process, the right of objection at any time to the process of the respective personal data, and in general all the rights provided in Chapter III of the General Regulation.

More specifically and particularly, as per the right of access and erasure of personal data, the below mentioned procedure is followed:

Therespectivedatasubject,shall address awrittenrequesttotheDataProtectionOfficer (DPO) oftheCompany, bysendingane-mailto[email protected], requesting access to his recorded personal data, and if he wishes, he can request their erasure.

The Data Protection Officer shall  respond to the respective query of the data  subject within fifteen (15) days, when he will inform the subject about the progress of his request, as well as per its implementation. Upon the above query of the data subject regarding the erasure  of his personal data, the Company erases  the recorded personal data, unless, there is an obligation or provision that requires the preservation  of the recorded personal data, by the effective legislation  or the applicable regulatory framework.

For the exercise of the above rights, as well as for any other information or question regarding the process of their personal data, the data subjects may contact Mrs. Margarita Skarou ([email protected], tel. 2106635982) who has been appointedthe Data Protection Officer of the Company "DEVELOPMENT OF NEW ALIMOS MARINA SINGLE MEMBER S.A.".

In case any of the above rights, is exercised (apart from  the right of access and erasure of data, as analyzed above) by the respective subject, the Company shall  take all possible measures to satisfy this request, within thirty (30) days of its receipt, when there will be respective updateon its progress. It is expressed  that the aforementioned deadline, can be extended for two (2) additional months, taking into account the complexity of the request, as well as the total number of requests in general. These rights are exercised at no costfor  the data  subject, unless they arefrequently repeated and due to theirexcessity, administrative costs are implied for the Company, in which case, the applicant will bear the relevant costs.
Furthermore, our Company shall  inform the subject about any violation of his personal data, in case it may endanger his rights and freedoms, and provided that it does not come  under one of the exceptions, explicitly provided by law.

In any case, the data subject has the right to appeal to the Hellenic Data Protection Authority (HDPA–Kifisias Avenue no. 1-3, P.C. 115 23, Athens, Telephone: 210 6475600, E-mail: [email protected]r, https://www.dpa.gr/) whether  he considers, that his rights regarding the process of his personal data are violated, and he has not been satisfied with the Company's response, as the Controller.

Ι. AMENDMENTS  IN THE CURRENT POLICY

The Company reserves the right toamend  this Policy at any time. The amendments in this Policy, will be published on the Website www.alimos-marina.gr, while the Policy is also available in printed form at the Headquarters of Alimos Marina (Administration Offices). The User must review the Policy for any amendments or additions, and the Company has no obligation to inform each User individuallyregarding  his rights.

DATE OF LAST UPDATE: 01/01/2021